10 ms·

You say that the tool has obvious non-infringing use and the article claims that security experts who have examined NanoCore say there’s nothing in the code to

by Strom 10y ago

You say that the tool has obvious non-infringing use and the article claims that security experts who have examined NanoCore say there’s nothing in the code to disprove Huddleston’s claim that he intended it for lawful use. I looked at a youtube video of NanoCore [1] and it's immediately obvious that all of the above is bullshit. This is just a modern version of Sub7. [2] Some features that NanoCore offers: * Disable webcam indicator light * Lock computer with a password of your choosing and show a message on the computer. The youtuber says it's for ransom. * Swap mouse button functions * Open CD tray * Keylogger * Extract passwords of various applications * Send SYN floods from all your controlled computers What exactly is the legitimate use of disabling the webcam indicator remotely? Combine this with the fact that NanoCore was originally launched on HackForums and I'd say this is a slam dunk case of a tool being purpose built for illegal activity. Now whether someone should be held accountable for building such tools without using it themselves is an interesting question. However please don't try to act like this tool was built for anything other than malicious activity. -- [1] https://www.youtube.com/watch?v=J1uzu6hzSQQ https://www.youtube.com/watch?v=J1uzu6hzSQQ [2] https://en.wikipedia.org/wiki/Sub7 https://en.wikipedia.org/wiki/Sub7

beardog 10y ago
While i'm not going to sit here and pretend that this RAT was built for law activity, metasploit payloads don't provide any indication to the 'victims' that their system has been infected either.
0xfeba 10y ago
I am inclined to agree with you, but man, it still scares me.
irq-1 10y ago
> What exactly is the legitimate use of disabling the webcam indicator remotely? I want to do that on a Pi camera at a remote location so animals aren't disturbed, or the people aren't aware they're being filmed. > ...a tool being purpose built for illegal activity. Intent isn't determined by how others use something, or what a YouTube video says the intent is.
- Strom 10y ago
  Is SYN flooding also to prevent disturbing animals?
  - kuschku 10y ago
    No, those are to win http://ipv6tree.bitnet.be/ http://ipv6tree.bitnet.be/
- raverbashing 10y ago
  > I want to do that on a Pi camera at a remote location so animals aren't disturbed Put a tape over it
  - homulilly 10y ago
    turning off the light seems easier and more thorough to me.
    - abeyer 10y ago
      Just removing the light that has no practical purpose in that case seems more thorough yet.
S_A_P 10y ago
On first pass I was pretty alarmed and thought this was a scary precedent being set. Further down in the comments I believe it was likened to arresting a gun manufacturer for someone pulling an armed robbery, and that the major vendors are getting a pass for the same functionality. However, I disagree. The functions listed above are not mainstream use cases for legitimate software. I also think of it as the same thing as arresting someone who hosts a child porn or silk road type of website. You may not be doing the crime, but you certainly are facilitating it in a big way. What I also think, however, is that this is probably a misguided kid with aspirations that exceeded his business savvy. He probably could be mentored into using some of his skills for good, so I hope the FBI doesn't proceed to ruin his life.
- Svexark 10y ago
  > The functions listed above are not mainstream use cases for legitimate software. Who decides what is "legitimate" software? Do you want to live in a world where you have to get the government's approval before writing code? How could a feature be "mainstream" if it isn't included in software? Should we have arrested Steve Jobs for the Macintosh because GUI wasn't "mainstream" when it came out?
  - manquer 10y ago
    It is simple, the law decides.. Whether the law is sane or sensible is a different matter ..
    - AnthonyMouse 10y ago
      Which law provides an unambiguous definition of "legitimate software"?
  - tracker1 10y ago
    For that matter... if it's not legitimate, then why does the hardware have the ability to do it? Why does camera hardware allow the light to be disabled during recording? I mean SYN is useful, and SYN flood might be useful for systems testing... that said, there are other tools for that, and RAT probably isn't the right place. In any case, this is definitely a slippery slope as there are "Security" companies that provide software that does all of this that act as US, local and other govt vendors.
AJ007 10y ago
Is this any different than the tools CIA employees and contractors built which were then used to conduct espionage against lawful American companies?
- cloakandswagger 10y ago
  "Do as we say, not as we do"
  - logfromblammo 10y ago
    "Well, when the president does it, that means it is not illegal." --Nixon
smhenderson 10y ago
I've only read the article linked here and had never heard of this tool before today so grain of salt and all that. But the article did mention he was hoping "anxious parents" would use it to monitor their kids activity. As a parent of two teenagers and a twenty-something I could see myself wanting to turn on a web cam without them knowing it. I hate to say it but my kids get up to some crazy stuff on the web and have defeated a lot of my efforts to monitor/block that activity. In the end I've had better luck just sitting down and talking openly with them about it. But there was a time where I was frustrated enough that I might have sunk to plain old spying on them... Anyway, that's just one use I could see for disabling the cam indicator. And the article does mention youtube videos and how frustrated he was to see what people were doing with the tool. He even added a "feature" where the user's license number was displayed in the program so if he could see it in such videos he could disable their copy. Did you see the actual author in any youtube videos?
- cwyers 10y ago
  I'm also a parent, and I am of the opinion that being a teenager doesn't mean you should have your computer hacked to be monitored like this. There's all kinds of legitimate admin tools you can use to monitor their activity. If they deliberately circumvent them, physically take the computer away. Turning on a webcam surreptitiously to monitor them is not cool.
  - smhenderson 10y ago
    I think I said as much in my comment.
  - bitJericho 10y ago
    Or you could, you know, just teach them the consequences. Eg, talking to catfish, child porn charges, etc.
- ThrustVectoring 10y ago
  >As a parent of two teenagers and a twenty-something I could see myself wanting to turn on a web cam without them knowing it. I hate to say it but my kids get up to some crazy stuff on the web and have defeated a lot of my efforts to monitor/block that activity. What the fuck. It's well past time to give real responsibility and freedom. This sort of behavior can and will cause long-term damage, pain, and resentment to your own children. And for what, to selfishly assuage your own anxiety? IMO, riding roughshod over a basic fundamental need for privacy is child abuse, and it ought to be more widely considered as such.
throwawayasoij 10y ago
Does it matter that the CIA and FBI are building these tools all the time? It takes a few characters to blow away a drive on the Linux command line, should those characters be illegal because they're potentially dangerous? Banning software you don't like is a slippery slope, researchers publish proof of concepts far worse all the time.
zaroth 10y ago
Thanks for posting the video, it's a nice demo of the tool. This is actually a really awesome program I could see myself using to control and monitor my own machines. Yes, this clearly has the kitchen sink of functionality thrown in. In many ways this looks like a platform for experimentation, with the developer clearly building this as a labor of love and learning as much, if not more so, than a commercial enterprise. > What exactly is the legitimate use of disabling the webcam indicator remotely? In a context menu labeled 'Swiss Army Knife' there's an option to Enable/Disable webcam light. There's also options like making the computer speaker beep. By the way, most video recording software provide options to toggle the webcam light in advanced menus. Under an option called 'NanoStress' you can send several traffic patterns. Yes, it even has a bit of iPerf built in. Frankly this is a really neat tool with tons of useful applications. It's highly distressing that this could get you raided and charged in Federal court with conspiracy.
- tptacek 10y ago
  You can see yourself installing a RAT with a keylogger, webcam light disabler, and SYN flood feature to manage your own computers?
  - nadermx 10y ago
    Why not? Could be used to see if you have been hacked and there is something/someone else using it no? A different way to monitor the logs of a system
  - FilterSweep 10y ago
    Are the features selectively installed, opt-in installed, or configured downloaded, as with most modern software?
  - zaroth 10y ago
    Certainly, this program has a number of features which I needed on a daily basis in my WiFi testing lab. We had hundreds of headless machines running in isolation chambers which needed automated tools for remote controlling all aspects of the system. Back in the day, we programmed our own agent to do things like provide remote program execution, file system access, NDIS/OLE/DCOM control, traffic generation, packet capture, system profiling, key-press and mouse-click macros for UI automation, etc. We had many of the same options for automating how the agent was installed, such as customizing the build for automatic deployment across various environments. We had automated PXE combined with a Ghost program where we could snapshot and deploy images to the machines straight from a TCL API. We had ways to throw up screens on the UI to indicate tests were in progress and lock the machine for interactive use. About 15 years ago I actually spent several man-years building much of the functionality which is now contained within NanoCore. And while we didn't provide specifically SYN flood, we wrote wrappers for iperf to be able to load the executable onto the machine, and a TCL API around running iperf in server or client mode and capturing and parsing the output. We also wrote our own L2 traffic generator which trivially could have been used to generate SYN floods, although we were more interested in particular with generating "pure" traffic patterns to find the synthetic maximum possible throughput, as well as ideally sized packets for WiFi range and ACI testing. The Azimuth WSC -- as it was called -- met every definition of a modern day "RAT" except that of course it's official purpose wasn't malware.
syshum 10y ago
>>Disable webcam indicator light Schools and corporation do this all the time for theft Reaction (take a photo of the thief with out them knowing), it is a feature they want, Some Schools have gotten in trouble for turning it on and catching children in the rooms >Lock computer with a password of your choosing and show a message on the computer. The youtuber says it's for ransom. Again, legitimate Theft Reaction > Swap mouse button functions ..Open CD tray Is that malicious, really. Enough for jail time >* Keylogger Plenty of Corporations have keyloggers on their systems, some corporations even go as far as 24/7 keylogging and screen recording while the system is on. >>* Send SYN floods from all your controlled computers That one you may have a case for... the rest all have legit purposes used today by Enterprises worldwide
- Ajedi32 10y ago
  > Send SYN floods from all your controlled computers Seems potentially useful for stress testing. Especially if you're trying to make your service more resistant to DDoS attacks.
  - tptacek 10y ago
    This is about as credible as saying that the Michelangelo virus was really intended as a remote wipe tool for IT departments.
    - mikecb 10y ago
      There's a long tradition there, wasn't BO2K non-ironically marketed as a system admin tool?
      - tptacek 10y ago
        No, it was ironically marketed as a system administration tool, for exactly the subtextual reason as this story suggests one might.
- tptacek 10y ago
  Can you name a major corporation that does "24/7 keylogging"?
criddell 10y ago
Why are indicator lights software controllable?
- Strom 10y ago
  It varies by manufacturer/model. Some have a hardware/firmware only solution that can't really be turned off from the OS. Other times it's controlled by the driver. Often there isn't an API for controlling it, but you can memory patch the driver. As for why, I'd say it's just another case of security design by people who don't fully understand security. Similarly to why toy bears are accessible from the internet. [1] -- [1] https://arstechnica.com/security/2017/02/creepy-iot-teddy-bear-leaks-2-million-parents-and-kids-voice-messages/ https://arstechnica.com/security/2017/02/creepy-iot-teddy-be...
BearGoesChirp 10y ago
One very simple use case that would apply to almost any sort of hack, no matter how bad, is to lawfully use it to show someone that it can be done. Say a teacher using this at school on a sample laptop as a PSA to let students know the danger of leaving actively connected webcams in their room and not trusting the light indicator on them to show when it is working. Yeah, you could just tell the students, but sometimes showing them the hack in action works far better to convince them.
- Strom 10y ago
  Educational use is definitely interesting. That's largely how I've become an expert at security myself, because there is so much security related information & resources available under the disclaimer of "educational purposes only". However I do think that there are some interesting corner cases. Looking at extreme cases, what about selling nuclear bombs for educational purposes? There are certainly scientific tests that could be done with the bomb and humanity would be better off for having done it. However I think that selling nuclear bombs without restrictions, or launching the sale campaign in the middle of Raqqa would lead to undesirable results. This leads me to belive that we as a global society certainly aren't ready for every tool to be available unrestricted for educational purposes. What's more, I don't think we're even ready for every tutorial to be available unrestricted, because the cross section of people who can follow the tutorial and also want to end civilization as we know it is still too numerous. I also don't like censorship or the idea of hindering scientific progress. I would definitely like to progress towards a world where nuclear bombs can be sold at WalMart and nobody would cause problems with them. We're not there yet and I'm not sure how exactly we can even get there. Until we do, as much as I hate to say it, even educational purposes will have to be sacrificed for the greater good. Where exactly we draw the line is a tough nut to crack and I personally don't hold a strong opinion of a specific line yet.
  - ameister14 10y ago
    I think there's a lot of room to draw the line between nuclear bombs and a RAT.
Auxilio 10y ago
I hope you understand they where 3rd party external plugins, not created by Huddleston.
avn2109 10y ago
>> "... a tool being purpose built for illegal activity." Attempting to discern the author's design intent ex-post-facto strikes me as very difficult. Also, this does not admit the possibility of a tool being designed for a nefarious purpose, but later turning out to be useful for beneficial purposes. E.g. A rifle designed to kill people later turns out to be great for deer hunting (trivial example but you get the idea).
AIMunchkin 10y ago
Ergo we should immediately arrest all gunmakers because it's hard to think of another use for guns besides killing things or practicing the art of killing things, no?
scott_karana 10y ago
Do you also think the Metasploit authors should have their homes raided, and criminal charges raised?
- Strom 10y ago
  Also? I haven't been a proponent of any raids. I'm not even sure if in-the-mail charges are in order for creating these trojans without using them offensively. I'm talking about the intent and purpose of the application, not what should be done about it.
stronglikedan 10y ago
Just because you don't have a legitimate use case doesn't mean someone else doesn't. Your mentality can be very dangerous with regards to eroding our cherished liberties.
- manquer 10y ago
  Is there any legitimate use case for triggering SYN flood ?
  - FilterSweep 10y ago
    Stress test your servers (although, you could argue this could be done at a better level from a non remote tool).
true_religion 10y ago
> What exactly is the legitimate use of disabling the webcam indicator remotely? We want our webcam light to blink when there are connection issues, or transcoding issues during a conversation and we had to degrade QoS. We use blinking to indicate degraded service, and multiple light colours to indicate level of service.
LordKano 10y ago
What exactly is the legitimate use of disabling the webcam indicator remotely? Employer monitoring. Parental monitoring.
- deleted 10y ago
  [deleted]
vilhelm_s 10y ago
It seems that functionality is provided by plugins though? You can see in the menu that he has at least "MultiCore" and "Nanonana" installed. I think the default version of the program does not come with these, e.g. here is a forum thread about someone asking how to disable the camera light and getting pointed to a plugin: https://webcache.googleusercontent.com/search?q=cache:RGNVD_seBpQJ:https://hackforums.net/printthread.php%3Ftid%3D4549412+&cd=1&hl=en&ct=clnk&gl=us&client=firefox-a https://webcache.googleusercontent.com/search?q=cache:RGNVD_...
- ajnin 10y ago
  Good point, the only dubious feature is the "recover passwords" one, but others clearly black hat in nature like "recover steam file", "open meatspin", "SYN flood", "lock computer with password" are from plugins.
kordless 10y ago
Please visualize and define various malicious activity.
xellisx 10y ago
Some of these feature remind me of a "tool" back in the mid/late 90's.
geocar 10y ago
> * Disable webcam indicator light ... What exactly is the legitimate use of disabling the webcam indicator remotely? Cheaper than opening the laptop frame and cutting/shorting the LED, allows you to take pictures of people trying to log into your computer without them noticing. Company computer does this on every invalid login, and makes me review them when I log in successfully. They also make sure when I enter my password I'm not reading it from anything (like a phone or a text file), and when I use the 2FA card that there aren't any wires sticking out from it. I also imagine it takes random pictures, and I'm glad the light is disabled because it would probably annoy me to have it blink all the time. > * Lock computer with a password of your choosing and show a message on the computer. My company laptop does this if someone steals it, telling them that this computer is stolen and has embedded GPS and 3G in it so the owners know where it is. > * Swap mouse button functions Left-handed people. Sinister, I know. > * Open CD tray Before DVD and Blu-Ray made it common to fit everything on a single disc, many applications would copy files from multiple CD discs and would open the tray as a prompt to swap the disc at various stages of the installation process. > * Keylogger One of the environments I work in has strict audit policy: Everything is logged to make sure nobody is passing notes in some other way (chat, a text file on a shared server, a drafts folder, etc). Indeed, someone was using a keystroke-stuffing USB device to transfer files into the network and the keylogger was the tool that detected it. > * Extract passwords of various applications I use the Apple Keychain. It has an option to let me get my password. This is useful when I log in via the website, which saves a generated password, but then I log in via the app and the idiot programmer has made their own password prompt (instead of using the iCloud-enabled password API). Sometimes I want to go the other way, and I'm lucky that most programmers are idiots and just wang cleartext passwords into a text file or a sqlite file, or trivially "encrypting it"[1] because otherwise I might not be able to recover my access. [1]: https://www.unix-ag.uni-kl.de/~massar/bin/cisco-decode https://www.unix-ag.uni-kl.de/~massar/bin/cisco-decode > * Send SYN floods from all your controlled computers I usually use hping to do this because I want to know that I can protect my applications and services from anyone who will spend less than they can make by knocking my services offline. I wish more programmers did this, but I'm frequently disappointed by bad engineering. Honestly, that someone is so willing to judge someone they don't even know as malicious simply because of their own ignorance and lack of imagination, is what I find most disappointing of all. > Combine [all of] this with the fact that NanoCore was originally launched on HackForums and I'd say this is a slam dunk case of a tool being purpose built for illegal activity. It probably is, but if that happens I hope it will be overturned like some other slam dunk cases[2]. [2]: http://legal-dictionary.thefreedictionary.com/Jim+Crow+Laws http://legal-dictionary.thefreedictionary.com/Jim+Crow+Laws > Now whether someone should be held accountable for building such tools without using it themselves is an interesting question. I've never pondered it before, and I feel like spending my time arguing about it could be better spent elsewhere, so in my view, it is the exact opposite of an interesting question. > However please don't try to act like this tool was built for anything other than malicious activity. Only if you don't try to act like this tool was built for malicious activity, because to be completely frank: You don't know this person, or this tool, or this space, and that the US government agrees with you isn't evidence that you're smart or right, nor will I respect your prejudices for it.

by Strom 10y ago

beardog 10y ago

While i'm not going to sit here and pretend that this RAT was built for law activity, metasploit payloads don't provide any indication to the 'victims' that their system has been infected either.

0xfeba 10y ago

I am inclined to agree with you, but man, it still scares me.

irq-1 10y ago

> What exactly is the legitimate use of disabling the webcam indicator remotely? I want to do that on a Pi camera at a remote location so animals aren't disturbed, or the people aren't aware they're being filmed. > ...a tool being purpose built for illegal activity. Intent isn't determined by how others use something, or what a YouTube video says the intent is.

Strom 10y ago
Is SYN flooding also to prevent disturbing animals?
- kuschku 10y ago
  No, those are to win http://ipv6tree.bitnet.be/ http://ipv6tree.bitnet.be/
raverbashing 10y ago
> I want to do that on a Pi camera at a remote location so animals aren't disturbed Put a tape over it
- homulilly 10y ago
  turning off the light seems easier and more thorough to me.
  - abeyer 10y ago
    Just removing the light that has no practical purpose in that case seems more thorough yet.

S_A_P 10y ago

On first pass I was pretty alarmed and thought this was a scary precedent being set. Further down in the comments I believe it was likened to arresting a gun manufacturer for someone pulling an armed robbery, and that the major vendors are getting a pass for the same functionality. However, I disagree. The functions listed above are not mainstream use cases for legitimate software. I also think of it as the same thing as arresting someone who hosts a child porn or silk road type of website. You may not be doing the crime, but you certainly are facilitating it in a big way. What I also think, however, is that this is probably a misguided kid with aspirations that exceeded his business savvy. He probably could be mentored into using some of his skills for good, so I hope the FBI doesn't proceed to ruin his life.

Svexark 10y ago
> The functions listed above are not mainstream use cases for legitimate software. Who decides what is "legitimate" software? Do you want to live in a world where you have to get the government's approval before writing code? How could a feature be "mainstream" if it isn't included in software? Should we have arrested Steve Jobs for the Macintosh because GUI wasn't "mainstream" when it came out?
- manquer 10y ago
  It is simple, the law decides.. Whether the law is sane or sensible is a different matter ..
  - AnthonyMouse 10y ago
    Which law provides an unambiguous definition of "legitimate software"?
- tracker1 10y ago
  For that matter... if it's not legitimate, then why does the hardware have the ability to do it? Why does camera hardware allow the light to be disabled during recording? I mean SYN is useful, and SYN flood might be useful for systems testing... that said, there are other tools for that, and RAT probably isn't the right place. In any case, this is definitely a slippery slope as there are "Security" companies that provide software that does all of this that act as US, local and other govt vendors.

AJ007 10y ago

Is this any different than the tools CIA employees and contractors built which were then used to conduct espionage against lawful American companies?

cloakandswagger 10y ago
"Do as we say, not as we do"
- logfromblammo 10y ago
  "Well, when the president does it, that means it is not illegal." --Nixon

smhenderson 10y ago

I've only read the article linked here and had never heard of this tool before today so grain of salt and all that. But the article did mention he was hoping "anxious parents" would use it to monitor their kids activity. As a parent of two teenagers and a twenty-something I could see myself wanting to turn on a web cam without them knowing it. I hate to say it but my kids get up to some crazy stuff on the web and have defeated a lot of my efforts to monitor/block that activity. In the end I've had better luck just sitting down and talking openly with them about it. But there was a time where I was frustrated enough that I might have sunk to plain old spying on them... Anyway, that's just one use I could see for disabling the cam indicator. And the article does mention youtube videos and how frustrated he was to see what people were doing with the tool. He even added a "feature" where the user's license number was displayed in the program so if he could see it in such videos he could disable their copy. Did you see the actual author in any youtube videos?

cwyers 10y ago
I'm also a parent, and I am of the opinion that being a teenager doesn't mean you should have your computer hacked to be monitored like this. There's all kinds of legitimate admin tools you can use to monitor their activity. If they deliberately circumvent them, physically take the computer away. Turning on a webcam surreptitiously to monitor them is not cool.
- smhenderson 10y ago
  I think I said as much in my comment.
- bitJericho 10y ago
  Or you could, you know, just teach them the consequences. Eg, talking to catfish, child porn charges, etc.
ThrustVectoring 10y ago
>As a parent of two teenagers and a twenty-something I could see myself wanting to turn on a web cam without them knowing it. I hate to say it but my kids get up to some crazy stuff on the web and have defeated a lot of my efforts to monitor/block that activity. What the fuck. It's well past time to give real responsibility and freedom. This sort of behavior can and will cause long-term damage, pain, and resentment to your own children. And for what, to selfishly assuage your own anxiety? IMO, riding roughshod over a basic fundamental need for privacy is child abuse, and it ought to be more widely considered as such.

throwawayasoij 10y ago

Does it matter that the CIA and FBI are building these tools all the time? It takes a few characters to blow away a drive on the Linux command line, should those characters be illegal because they're potentially dangerous? Banning software you don't like is a slippery slope, researchers publish proof of concepts far worse all the time.

zaroth 10y ago

Thanks for posting the video, it's a nice demo of the tool. This is actually a really awesome program I could see myself using to control and monitor my own machines. Yes, this clearly has the kitchen sink of functionality thrown in. In many ways this looks like a platform for experimentation, with the developer clearly building this as a labor of love and learning as much, if not more so, than a commercial enterprise. > What exactly is the legitimate use of disabling the webcam indicator remotely? In a context menu labeled 'Swiss Army Knife' there's an option to Enable/Disable webcam light. There's also options like making the computer speaker beep. By the way, most video recording software provide options to toggle the webcam light in advanced menus. Under an option called 'NanoStress' you can send several traffic patterns. Yes, it even has a bit of iPerf built in. Frankly this is a really neat tool with tons of useful applications. It's highly distressing that this could get you raided and charged in Federal court with conspiracy.

tptacek 10y ago
You can see yourself installing a RAT with a keylogger, webcam light disabler, and SYN flood feature to manage your own computers?
- nadermx 10y ago
  Why not? Could be used to see if you have been hacked and there is something/someone else using it no? A different way to monitor the logs of a system
- FilterSweep 10y ago
  Are the features selectively installed, opt-in installed, or configured downloaded, as with most modern software?
- zaroth 10y ago
  Certainly, this program has a number of features which I needed on a daily basis in my WiFi testing lab. We had hundreds of headless machines running in isolation chambers which needed automated tools for remote controlling all aspects of the system. Back in the day, we programmed our own agent to do things like provide remote program execution, file system access, NDIS/OLE/DCOM control, traffic generation, packet capture, system profiling, key-press and mouse-click macros for UI automation, etc. We had many of the same options for automating how the agent was installed, such as customizing the build for automatic deployment across various environments. We had automated PXE combined with a Ghost program where we could snapshot and deploy images to the machines straight from a TCL API. We had ways to throw up screens on the UI to indicate tests were in progress and lock the machine for interactive use. About 15 years ago I actually spent several man-years building much of the functionality which is now contained within NanoCore. And while we didn't provide specifically SYN flood, we wrote wrappers for iperf to be able to load the executable onto the machine, and a TCL API around running iperf in server or client mode and capturing and parsing the output. We also wrote our own L2 traffic generator which trivially could have been used to generate SYN floods, although we were more interested in particular with generating "pure" traffic patterns to find the synthetic maximum possible throughput, as well as ideally sized packets for WiFi range and ACI testing. The Azimuth WSC -- as it was called -- met every definition of a modern day "RAT" except that of course it's official purpose wasn't malware.

syshum 10y ago

>>Disable webcam indicator light Schools and corporation do this all the time for theft Reaction (take a photo of the thief with out them knowing), it is a feature they want, Some Schools have gotten in trouble for turning it on and catching children in the rooms >Lock computer with a password of your choosing and show a message on the computer. The youtuber says it's for ransom. Again, legitimate Theft Reaction > Swap mouse button functions ..Open CD tray Is that malicious, really. Enough for jail time >* Keylogger Plenty of Corporations have keyloggers on their systems, some corporations even go as far as 24/7 keylogging and screen recording while the system is on. >>* Send SYN floods from all your controlled computers That one you may have a case for... the rest all have legit purposes used today by Enterprises worldwide

Ajedi32 10y ago
> Send SYN floods from all your controlled computers Seems potentially useful for stress testing. Especially if you're trying to make your service more resistant to DDoS attacks.
- tptacek 10y ago
  This is about as credible as saying that the Michelangelo virus was really intended as a remote wipe tool for IT departments.
  - mikecb 10y ago
    There's a long tradition there, wasn't BO2K non-ironically marketed as a system admin tool?
    - tptacek 10y ago
      No, it was ironically marketed as a system administration tool, for exactly the subtextual reason as this story suggests one might.
tptacek 10y ago
Can you name a major corporation that does "24/7 keylogging"?

criddell 10y ago

Why are indicator lights software controllable?

Strom 10y ago
It varies by manufacturer/model. Some have a hardware/firmware only solution that can't really be turned off from the OS. Other times it's controlled by the driver. Often there isn't an API for controlling it, but you can memory patch the driver. As for why, I'd say it's just another case of security design by people who don't fully understand security. Similarly to why toy bears are accessible from the internet. [1] -- [1] https://arstechnica.com/security/2017/02/creepy-iot-teddy-bear-leaks-2-million-parents-and-kids-voice-messages/ https://arstechnica.com/security/2017/02/creepy-iot-teddy-be...

BearGoesChirp 10y ago

One very simple use case that would apply to almost any sort of hack, no matter how bad, is to lawfully use it to show someone that it can be done. Say a teacher using this at school on a sample laptop as a PSA to let students know the danger of leaving actively connected webcams in their room and not trusting the light indicator on them to show when it is working. Yeah, you could just tell the students, but sometimes showing them the hack in action works far better to convince them.

Strom 10y ago
Educational use is definitely interesting. That's largely how I've become an expert at security myself, because there is so much security related information & resources available under the disclaimer of "educational purposes only". However I do think that there are some interesting corner cases. Looking at extreme cases, what about selling nuclear bombs for educational purposes? There are certainly scientific tests that could be done with the bomb and humanity would be better off for having done it. However I think that selling nuclear bombs without restrictions, or launching the sale campaign in the middle of Raqqa would lead to undesirable results. This leads me to belive that we as a global society certainly aren't ready for every tool to be available unrestricted for educational purposes. What's more, I don't think we're even ready for every tutorial to be available unrestricted, because the cross section of people who can follow the tutorial and also want to end civilization as we know it is still too numerous. I also don't like censorship or the idea of hindering scientific progress. I would definitely like to progress towards a world where nuclear bombs can be sold at WalMart and nobody would cause problems with them. We're not there yet and I'm not sure how exactly we can even get there. Until we do, as much as I hate to say it, even educational purposes will have to be sacrificed for the greater good. Where exactly we draw the line is a tough nut to crack and I personally don't hold a strong opinion of a specific line yet.
- ameister14 10y ago
  I think there's a lot of room to draw the line between nuclear bombs and a RAT.

Auxilio 10y ago

I hope you understand they where 3rd party external plugins, not created by Huddleston.

avn2109 10y ago

>> "... a tool being purpose built for illegal activity." Attempting to discern the author's design intent ex-post-facto strikes me as very difficult. Also, this does not admit the possibility of a tool being designed for a nefarious purpose, but later turning out to be useful for beneficial purposes. E.g. A rifle designed to kill people later turns out to be great for deer hunting (trivial example but you get the idea).

AIMunchkin 10y ago

Ergo we should immediately arrest all gunmakers because it's hard to think of another use for guns besides killing things or practicing the art of killing things, no?

scott_karana 10y ago

Do you also think the Metasploit authors should have their homes raided, and criminal charges raised?

Strom 10y ago
Also? I haven't been a proponent of any raids. I'm not even sure if in-the-mail charges are in order for creating these trojans without using them offensively. I'm talking about the intent and purpose of the application, not what should be done about it.

stronglikedan 10y ago

Just because you don't have a legitimate use case doesn't mean someone else doesn't. Your mentality can be very dangerous with regards to eroding our cherished liberties.

manquer 10y ago
Is there any legitimate use case for triggering SYN flood ?
- FilterSweep 10y ago
  Stress test your servers (although, you could argue this could be done at a better level from a non remote tool).

true_religion 10y ago

> What exactly is the legitimate use of disabling the webcam indicator remotely? We want our webcam light to blink when there are connection issues, or transcoding issues during a conversation and we had to degrade QoS. We use blinking to indicate degraded service, and multiple light colours to indicate level of service.

LordKano 10y ago

What exactly is the legitimate use of disabling the webcam indicator remotely? Employer monitoring. Parental monitoring.

deleted 10y ago
[deleted]

vilhelm_s 10y ago

It seems that functionality is provided by plugins though? You can see in the menu that he has at least "MultiCore" and "Nanonana" installed. I think the default version of the program does not come with these, e.g. here is a forum thread about someone asking how to disable the camera light and getting pointed to a plugin: https://webcache.googleusercontent.com/search?q=cache:RGNVD_seBpQJ:https://hackforums.net/printthread.php%3Ftid%3D4549412+&cd=1&hl=en&ct=clnk&gl=us&client=firefox-a https://webcache.googleusercontent.com/search?q=cache:RGNVD_...

ajnin 10y ago
Good point, the only dubious feature is the "recover passwords" one, but others clearly black hat in nature like "recover steam file", "open meatspin", "SYN flood", "lock computer with password" are from plugins.

kordless 10y ago

Please visualize and define various malicious activity.

xellisx 10y ago

Some of these feature remind me of a "tool" back in the mid/late 90's.

geocar 10y ago

> * Disable webcam indicator light ... What exactly is the legitimate use of disabling the webcam indicator remotely? Cheaper than opening the laptop frame and cutting/shorting the LED, allows you to take pictures of people trying to log into your computer without them noticing. Company computer does this on every invalid login, and makes me review them when I log in successfully. They also make sure when I enter my password I'm not reading it from anything (like a phone or a text file), and when I use the 2FA card that there aren't any wires sticking out from it. I also imagine it takes random pictures, and I'm glad the light is disabled because it would probably annoy me to have it blink all the time. > * Lock computer with a password of your choosing and show a message on the computer. My company laptop does this if someone steals it, telling them that this computer is stolen and has embedded GPS and 3G in it so the owners know where it is. > * Swap mouse button functions Left-handed people. Sinister, I know. > * Open CD tray Before DVD and Blu-Ray made it common to fit everything on a single disc, many applications would copy files from multiple CD discs and would open the tray as a prompt to swap the disc at various stages of the installation process. > * Keylogger One of the environments I work in has strict audit policy: Everything is logged to make sure nobody is passing notes in some other way (chat, a text file on a shared server, a drafts folder, etc). Indeed, someone was using a keystroke-stuffing USB device to transfer files into the network and the keylogger was the tool that detected it. > * Extract passwords of various applications I use the Apple Keychain. It has an option to let me get my password. This is useful when I log in via the website, which saves a generated password, but then I log in via the app and the idiot programmer has made their own password prompt (instead of using the iCloud-enabled password API). Sometimes I want to go the other way, and I'm lucky that most programmers are idiots and just wang cleartext passwords into a text file or a sqlite file, or trivially "encrypting it"[1] because otherwise I might not be able to recover my access. [1]: https://www.unix-ag.uni-kl.de/~massar/bin/cisco-decode https://www.unix-ag.uni-kl.de/~massar/bin/cisco-decode > * Send SYN floods from all your controlled computers I usually use hping to do this because I want to know that I can protect my applications and services from anyone who will spend less than they can make by knocking my services offline. I wish more programmers did this, but I'm frequently disappointed by bad engineering. Honestly, that someone is so willing to judge someone they don't even know as malicious simply because of their own ignorance and lack of imagination, is what I find most disappointing of all. > Combine [all of] this with the fact that NanoCore was originally launched on HackForums and I'd say this is a slam dunk case of a tool being purpose built for illegal activity. It probably is, but if that happens I hope it will be overturned like some other slam dunk cases[2]. [2]: http://legal-dictionary.thefreedictionary.com/Jim+Crow+Laws http://legal-dictionary.thefreedictionary.com/Jim+Crow+Laws > Now whether someone should be held accountable for building such tools without using it themselves is an interesting question. I've never pondered it before, and I feel like spending my time arguing about it could be better spent elsewhere, so in my view, it is the exact opposite of an interesting question. > However please don't try to act like this tool was built for anything other than malicious activity. Only if you don't try to act like this tool was built for malicious activity, because to be completely frank: You don't know this person, or this tool, or this space, and that the US government agrees with you isn't evidence that you're smart or right, nor will I respect your prejudices for it.